A critical vulnerability in the RabbitMQ amqp091-go library allows a compromised broker to trigger a denial of service via a specially crafted message, potentially disrupting critical application connectivity.

The vulnerability stems from an incorrect numeric type conversion where a signed int32 is used to process byte-array lengths. An unauthenticated attacker acting as a malicious or compromised broker can supply an out-of-range value that causes a runtime panic, crashing the client application.

Successful exploitation of this vulnerability results in a denial of service for the client process, which can lead to significant application downtime and loss of connectivity to the message broker. Given the CVSS score of 8.9, this is a high-severity issue that directly threatens the availability of integrated services and business operations relying on RabbitMQ for data exchange.

Immediate Action: Update the amqp091-go library to version 1.13.0 or later to include the necessary input validation fixes.

Proactive Monitoring: Monitor application logs for unexpected process terminations or "len out of range" panic messages originating from the AMQP client component.

Compensating Controls: Ensure that message brokers are secured and restricted to trusted entities to prevent unauthorized or malicious brokers from interacting with the client library.

Public Exploit Available: No (exploit_available: false)

The risk posed by this vulnerability is significant due to its potential to cause arbitrary process crashes within the messaging infrastructure. Development teams should prioritize updating the amqp091-go dependency to version 1.13.0 in their next deployment cycle to ensure system stability and resilience against malicious message payloads.